Over the last several days, our Research Team has continued to analyze artifacts associated with the exploitation of Citrix NetScaler CVE-2026-88771 and CVE-2026-88772. As more samples, technical reports and information from partners became available, we extended the...
On September 27, 2026, Citrix published security bulletin CTX697096 covering eight vulnerabilities in NetScaler ADC and NetScaler Gateway. This post focuses on CVE-2026-88771, an unauthenticated command execution vulnerability affecting default deployments, and...
The difficult part begins when an AI system is allowed to change production. Over the last few weeks, I have had the same discussion several times. Public reports increasingly describe AI being used across large parts of an intrusion. The obvious question is: Where is...
Over the past days, many of our customers have seen reports about a critical remote code execution vulnerability in React Server Components (CVE-2025-55182) and the related Next.js vulnerability (CVE-2025-66478). These issues have received a lot of attention and have...
As someone who has spent many years researching attacks and supporting incident response teams, I’ve seen one question come up again and again: How do we return to a verified clean state after an intrusion? In every ransomware case, in every targeted espionage...
We’re pleased to announce a new technology partnership between Nextron and Arctic Wolf, a global leader in security operations, and one of the world’s largest commercial Security Operations Centers (SOCs). As part of the partnership, Arctic Wolf will incorporate...
Many of our customers value the broad module support and high detection coverage found in our professional-grade products. However, we are also committed to continuously improving our free tools, ensuring that the gap in detection capabilities does not grow too wide....
We are excited to announce a strategic partnership between Nextron Systems and Threatray AG. This collaboration aims to significantly enhance our existing threat detection capabilities and further improve the precision and sensitivity of our detection signatures....
Antivirus engines and EDRs have their place – no doubt. But what happens when malware simply slips through their nets? What if the malicious file was never executed? What if the incident happened months ago? That’s where THOR comes in. Our compromise assessment...
We are pleased to announce a significant enhancement for users of THOR Cloud and THOR Cloud Lite: YARA Forge rule sets are now available for integration. YARA Forge is a curated, quality-assured feed of YARA rules developed as a private project. It automates the...
In recent days, major security companies such as ReliaQuest and Onapsis have disclosed the active exploitation of CVE-2025-31324, a critical vulnerability in SAP NetWeaver’s Visual Composer component. The vulnerability allows unauthenticated attackers to upload...
Nextron Systems officially announces the End of Life (EOL) and End of Support (EOS) for THOR version 10.6, our former stable forensic scanner version. Effective December 31, 2025, THOR 10.6 will no longer receive updates, maintenance, or technical support. Background...
We’re introducing Forwarding Profiles in THOR Cloud Enterprise — a feature designed to streamline how scan results are delivered to external systems such as SIEMs, log collectors, or analysis platforms. Rather than downloading logs manually or relying on intermediate...
In my 2024 article, Cyber Security 2024: Key Trends Beyond the Hype, I aimed to stay rational and avoid hype—especially around AI—and pointed out that most real-world attacks still involved unpatched systems, weak credentials, and social engineering. Over the past...
Are you looking for an efficient, cloud-managed solution to streamline your threat detection and compromise assessments? This Black Friday, we’re offering 50% off all THOR Cloud scan packages. Why THOR Cloud? No Setup Hassle: Start scanning within minutes—no agents or...